EP0280035A2 - Method for the programme securing and for integrity checking of a secured programme - Google Patents

Abstract

To protect the programs contained in a system memory and to check their integrity, the programs are in each case coded in accordance with a symmetric cryptographic algorithm, by using a secret key which is stored protected against reading and during this process a test number is formed for each program and is stored in the system memory. For the integrity check, the programs are then again coded in the same manner and the test number obtained in each case during this process is compared with the test number stored during the first coding process. From the result of the comparison, a criterion can be derived for activating or blocking subsequent programs. <IMAGE>

Description

The invention relates to a method for securing the programs contained in the system memory of a data processing system against changes and for checking the integrity of programs that have been saved.

In data processing systems and computer systems built with them, the programs used for control and application, that is to say the program system consisting of the operating system and application system, are stored in a system memory, which can be, for example, a magnetic disk. When a data processing system is in operation, the programs are loaded into a working memory and processed in order to control the work processes of the data processing system as part of the operating system and to perform data processing tasks specified by the user in the application system.

Computer networks were developed with data processing systems in which individual computers communicate with each other. The largely automatic exchange of information must be secured against fraudulent manipulation, particularly in application areas such as banking, insurance, trade or administration. Such manipulations can also take place at program level and possibly lead to a computer executing unwanted additional, too few or changed commands, which can result in personal data being misused, processed and further processed be given, computer spending takes place for the benefit of an unauthorized person or other damage is inflicted on the user of the computer network or third parties.

Since it is very difficult for the user of a computer network to recognize manipulated programs and then to ensure integrity through appropriate corrective measures, it should be possible to automatically detect the manipulation of programs and also to automatically prevent manipulated programs from being executed. To secure programs, however, only methods are known so far that prevent unauthorized copying and use encryption for this purpose, which require special processors to execute such programs. Such security measures are intended to prevent the unauthorized economic evaluation and distribution of programs, but cannot detect tampering with programs in computer networks and prevent programs from being executed incorrectly. It is also possible to provide resource and access control by using passwords or user catalogs, confidentiality of data or physical measures such as authorization via special switches or keys in order to achieve a certain protection against unauthorized manipulation. However, these possibilities are comparatively worthless if a programmer or comparable qualified personnel has access to the computer network. Then, due to the special expertise, it is possible to manipulate programs despite the protective measures mentioned above.

The invention is therefore based on the object of specifying a method by which it is possible in a data processing system without significantly impairing the System performance to automatically detect tampering with programs and automatically prevent manipulated programs from taking effect.

This object is achieved by the invention for a method of the type mentioned above in that at least the programs which cause the system start-up are each encrypted according to a symmetrical cryptographic algorithm using a secret key which is stored in a read-protected manner to form a check digit which is stored in the system memory and for Integrity control with the system start-up of the data processing system initiates a successive repeated encoding of the programs and a comparison of the check digit thus obtained with the associated stored check digit, so that the activation of subsequent system startup steps or programs can be blocked in the event of a negative comparison result.

It is achieved by the invention that manipulations in the entire program system of a data processing system, that is to say in the operating system and in the application system, are automatically recognized and that operation can be interrupted immediately when a manipulation is detected when the system is started. This gives the effect of a "sealing" of the programs or a sealed system memory or system carrier, which has an effect when the data processing system is started, since the integrity check can then already take place. To secure the programs, the system memory is provided with additional information in the form of check digits which are the result of encryption steps which are carried out under On the basis of a secret key. In a computer network with an administration computer and several target computers, the system carrier for the respective target computer can be sealed in the administration computer in this way, the check digits serving as a logical seal for all programs stored on the system carrier that are loadable and necessary for the execution of the application system. These are the programs for the operating system that is memory-resident during computer operation as well as all programs that are stored in load libraries in executable form. Since a secret key is used for this sealing, which is stored in a read-protected manner, any unauthorized manipulation of the programs during the integrity check in the target computer, in which each program is re-encrypted using the same secret key to form the check digit, in which lead to an error signal to be carried out according to the invention, because the encryption performed for the manipulated program leads to a different check digit than was generated for the non-manipulated program in the management computer. The error signal can then be used to automatically block the activation of subsequent programs.

Encryption is performed using a symmetric cryptographic algorithm. As is known, this encryption principle offers a very high level of security against decryption. The best known embodiment is the DES algorithm (DES = DATA Encryption Standard). The decryption of an encrypted text works in exactly the reverse order of how the encryption of the plain text was carried out. Therefore, it is a symmetrical process. The high security of this algorithm is based on its mathematical properties, which lead to that the knowledge of the plain text and also the associated key text is not sufficient to determine the secret key with reasonable effort. In the context of the invention, however, the DES algorithm is not used to encrypt data, but rather to derive a checksum when encrypting programs.

The read-protected storage of the key used for the encryption is known per se, and for this purpose a special security module can be provided with which every computer in the computer network is equipped. This security module can contain a memory in which the key used is stored in a physically inaccessible form. As will be shown, the security module can also contain further hardware functional units that can further increase the security effect achieved with the invention.

Since the method according to the invention is carried out according to the sequence of the program system in a chain of successive encryption steps or control steps, the security achieved with it against the impact of unauthorized program manipulations can be further increased if the check digit of the first program that starts the system start-up, the so-called bootstrap program, is saved read-only. This additional measure prevents knowledge of the first check digit occurring in the control sequence and thus makes it impossible to attempt to use this check digit to possibly determine the secret key with which the bootstrap program was also encrypted. This is the first Checking process running as part of the integrity control is absolutely secure against unauthorized access and change.

• Fig. 1 die gegenseitige Zuordnung und Wechselwirkung von Komponenten eines Verwaltungsrechners bei der Durchführung des Verfahrens,
• Fig. 2 die gegenseitige Zuordnung und Wechselwirkung der Komponenten eines Zielrechners bei der Durchführung des Verfahrens,
• Fig. 3 die Darstellung des Ablaufs sukzessiver Prüf­schritte in einem Zielrechner,
• Fig. 4 den prinzipiellen Ablauf einer Verschlüsselung mit Prüfziffernbildung in einem Verschlüsse­lungsbaustein eines Verwaltungsrechners,
• Fig. 5 den prinzipiellen Ablauf einer Verschlüsselung und eines Prüfziffernvergleichs in einem Sicher­heitsbaustein eines Zielrechners und
• Fig. 6 den grundsätzlichen Aufbau eines Sicherheits­bausteins.

The invention is further explained below with reference to the figures. Show it:

• 1 shows the mutual assignment and interaction of components of an administrative computer when carrying out the method,
• 2 shows the mutual assignment and interaction of the components of a target computer when carrying out the method,
• 3 shows the sequence of successive test steps in a target computer,
• 4 shows the basic sequence of encryption with check digit formation in an encryption module of an administration computer,
• 5 shows the basic sequence of encryption and a check digit comparison in a security module of a target computer and
• Fig. 6 shows the basic structure of a safety module.

The following explains how the method according to the invention for backing up the programs in practical use with an administration computer and a target computer is carried out. The general rule here is that a system carrier that is executable for the commissioning of a target computer is provided with additional information in the form of the check digits. These check digits result from several encryption steps which are carried out using a secret key stored in a security module and to which the programs stored on the system carrier are subjected one after the other. The check digits are a logical seal for all programs stored on the system carrier of the target computer that are loadable and necessary for the execution of the application system. In addition, a check digit is generated for the start procedure, which is not stored in a legible form in the safety module. All other check digits can be stored in a freely accessible and readable manner on the system carrier, since the secret key is not accessible for the encryption steps. The security module of the target computer works in such a way that the key stored in it is only used to calculate a check digit while simultaneously comparing this check digit with a reference check digit supplied to the security module, so that the security module cannot output a check digit as a result, but only a yes No statement about whether the calculated check digit matches the reference check digit or not, ie in the target computer system, without knowledge of the secret key, no unauthorized PZ check digit calculation is possible.

After the system carrier has been provided with the additional information in the management computer in the manner described, this system carrier can be used in the target computer will. When the target computer system is started up, the integrity check is automatically initiated within the system start-up procedure that is running before the application is started. This results in several test steps, whereby a respective test step is only initiated if its execution code has been verified as unchanged by the previous test step.

The first test step is initiated by the bootstrap program and carried out in the safety module. This logic is therefore not physically freely accessible. If the bootstrap program is influenced or changed logically, such a change is detected during the first test step within the safety module and the safety module is deactivated so that it can no longer be used for the subsequent test steps and can therefore no longer be carried out.

1 shows how the system carrier and the security module of a target computer are subjected to the method according to the invention in the administration computer. On the left side of the vertical dashed line, the components of the management computer that are active as part of the backup procedure are shown schematically, while the passive components that have to be prepared for use in the target computer are shown on the right. Active components are an encryption program 11, with which the individual encryption steps to be carried out for the calculation of check digits are controlled, and an encryption module 12, which, controlled by the encryption program 11, supplies the individual programs to be secured, so that it provides one for each program Can give check digit. Passive components are a system carrier 15 with a check digit memory 14 and a plain text memory part 13 for saved programs and a security module 16 and a plain text memory 17 for a bootstrap program.

When preparing the passive components for use in the target computer, the bootstrap program is first output from the plain text memory 17, controlled by the encryption program 11, and the check digit to be assigned to the bootstrap program is calculated with the encryption module 12 using the secret key present in it. This is then output by the encryption module 12 and, under the control of the encryption program 11, supplied to the security module 16; With this step, the security key 16 is simultaneously given the secret key for read-protected storage. The check digits for the programs contained in the plain text storage part 13 of the system carrier 15 are then calculated and, controlled by the encryption program 11, stored in the check digit memory 14 of the system carrier 15. All encryption steps that are carried out in the encryption module 12 of the management computer are based on the secret key that is stored in the encryption module 12.

2 shows the manner in which a system carrier and security module prepared as described are generally used in a target computer for checking the integrity of programs. A test step is shown as part of a chain of test steps that can lie within the system start-up phase of the target computer. Active components are shown on the left side of a vertical dashed line, passive components of the target computer are shown on the right side. Each test step is carried out with a test program 21, which is referred to as a tester and which feeds the test objects, namely a program 23 to be tested and an associated check digit 24, to a security module 22 which, in the manner described, uses the secret key entered into it to calculate a check digit for each program fed to it and uses the compares the associated check digit 24 supplied to it. The safety module 22 transmits the comparison result, controlled by the checking program 21, in the form of a yes-no statement to the next checking entity, which is the program that has just been checked, provided that it is a yes statement. If the answer is no, a special function block is activated that can signal the error situation and, for example, interrupt the process of the system, trigger an error message or otherwise force a corrective action.

The entire process described above is initiated by a start signal which is supplied to the checking program 21 and which can be the yes statement of the previous checking step or else the initial start signal for the system start.

3 shows how a sequence of test steps of the type explained above can be carried out in a target computer. It is a representation of the chronological sequence of these test steps, which is divided into three phases from top to bottom, namely a switch-on phase, a system start-up phase and an application phase. As in FIGS. 1 and 2, the active components are shown on the left, the passive components on the right by a vertical dashed line. The individual test steps are continuously labeled S0, S1, S2, S3 ... Sn. In each test step S1 to Sn, a test program is shown as the active component and a program to be tested as the passive component. Here is the safety module not shown for the respective test step, since its function has already been explained with reference to FIG. 2.

When the target computer is switched on, a start signal ST is given to the bootstrap program 31 in the test step S0, which is started thereby and initiates the test step S1, which is thus the first step of the system startup phase. In test step S1, the bootstrap loader program 31 is fed to the security module 35 as a program to be tested, and encryption is carried out there using the secret key stored therein to calculate a check digit, which is then compared with the check digit stored in it for the bootstrap loader program 31. If the two check digits match, the result is a yes statement with which the bootstrap program 31 is controlled for the test step S2, so that for this test step it becomes the active component with which the resident operating system 32 is tested. A no statement made by the safety module 35 is fed to a control program 36, which can interrupt the further system start-up in a manner not shown here.

The resident operating system 32 is passed as a passive component with its individual program parts by the bootstrap program 31 to the security module (not shown for this test step S2), so that it can be subjected to encryption by which a check digit results. This check digit is compared with a check digit 34, which is simultaneously fed to the bootstrap program 31 or the security module connected to it. If the two check digits are identical, the result is a yes statement, which the resident operating system 32 controls and makes this the active component, which then causes the program parts from the load library 33 to be checked. This test step S3 is carried out like test step S2, so that at Correspondence between the check digit calculated in it and the check digit 34 associated with the program to be checked in each case yields a yes statement which is passed on to the control program 36, which can then start the operation of the application phase by means of a signal AW.

Further test steps of the type described here can of course be carried out within the application phase, provided that the individual application programs have been provided with a check digit in the administration computer, which can be stored in a check digit memory or in the loading library.

4 shows the generation of a check digit with an encryption module in the management computer in a block diagram. A program or test object P0 to be tested, for which a check digit PZ (P0) is to be calculated, is supplied to a division program, specifying an address ADR and a length LAE, in order to divide the test object into individual blocks B. These blocks B have the same length and are each subjected to a DES encryption step with a secret starting value SW and key IK at least once. An encryption program 41 is used for this purpose. The result C which occurs when a respective block B is encrypted is fed to the encryption program 41 as a starting value for the next block to be encrypted. The encryption result of the last block B is designated CE and represents the generated check digit PZ (P0), which can then be assigned to a program or saved in a security module as a check digit for a bootstrap program.

It should be noted that this generation of a check digit can be carried out with firmware or with software.

5 shows the execution of a check digit check in the target computer with a security module. The check digit control differs from the generation described with reference to FIG. 4 only in the input / output parameters and in a comparison process. An additional input parameter is a reference value RW, which serves as a comparison value after the calculation of the check digit PZ (P0). As a yes-no statement, the comparison result drives further test steps or a control program in the manner already described.

For the encryption shown in FIG. 4 and the check digit control shown in FIG. 5, the method of check digit control requires corresponding encryption methods, start values and keys.

6 shows the basic structure of a safety module 60 as an exemplary embodiment. It can be a hardware module that can be connected to the target computer via a plug connection. Commands and data are exchanged between the target computer and the safety module via this connection. Essential components of the security module are a processor 61 and a security hybrid module 62. The processor 61 is used to control the individual functions of the security module 60, for example for command decoding, for connecting data lines and for placing orders with the security hybrid module 62. This is a module in the manner of an integrated circuit, the modular components of which are applied discretely and can be provided with a ceramic cover overall. The hybrid module contains a processor 63, a DES module 64 and two key memories 65 and 66 with random access. The processor 63 is used for control and execution of commands and data between the DES module 64 and the read-protected key memories 65 and 66. Furthermore, it controls the external data flow to the processor 61. The DES module 64 controls the execution of the encryption method described. The key memory 65 is used to hold keys with a length of, for example, 64 bits, which are available to the application for DES encryption; the key memory 66 contains keys that can only be used by the processor 63 for internal functions, but not by external application programs. Access to a data line within the safety hybrid module is prevented by the ceramic cover mentioned. If the connection of the security module 60 to the target computer is interrupted, the key memory 65 is thereby deleted. The contents of the key store 66 can be held by a battery. If the hybrid module 62 is removed from the safety module 60, this means that all stored values are lost. This ensures that it is not possible to use the security module 60 outside the computer area.

Claims (4)

1. A method for securing the programs contained in the system memory of a data processing system against change and for the integrity control of secured programs, characterized in that at least the programs causing the system start-up are each encrypted according to a symmetrical cryptographic algorithm using a read-protected stored secret key to form a check digit , which is stored in the system memory, and that for the integrity control with the system start-up of the data processing system, a successive repeated encoding of the programs and a comparison of the check digit thus obtained with the associated stored check digit is initiated, so that in the event of a negative comparison result, the activation of subsequent system startup steps or programs can be locked. 2. The method according to claim 1, characterized in that the check digit of the first program causing the start of the system startup (bootstrap program) is stored in a read-protected manner. 3. The method according to claim 1 or 2, characterized in that the DES algorithm is used as the algorithm. 4. The method according to any one of claims 1 to 3, characterized in that to secure the programs in a computer network consisting of management computers and target computers, the first encryption for the system carriers of the target computers is carried out in the management computer and that the re-encryption for integrity control in each target computer Use of the same read-only stored secret key is automatically carried out with the system startup procedure.

Images